Website Privacy Policy

About this Policy

The types of personal data that GIS HK may be required to handle include information about current, past and prospective investors, officers and others with whom it transacts or communicates. The personal data, which may be held on paper or on a computer or other media, is subject to certain legal safeguards specified in the GDPR.

This policy and any other documents referred to in it sets out the basis on which GIS HK will process any personal data it collects from data subjects, or that is provided to it by data subjects or other sources.

This policy sets out rules on data protection and the legal conditions that must be satisfied when GIS HK collects, handles, processes, transfers and stores personal data.

The directors of GIS HK are collectively responsible for ensuring compliance with the GDPR, other applicable local privacy regulations and with this policy. The Board of GIS HK has concluded that a Data Protection Officer is not merited in this instance and has documented its reasons, as required by the GDPR. Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the CEO of GIS HK.

• Professional Clients (including elective professional clients)

• Retail Clients (including corporate and individual retail clients)

Your classification will depend on a combination of quantitative and qualitative factors, including:

Definition of terms used in this Policy

• Data is information which is stored electronically, on a computer, or in paper-based structured filing systems.

• Data Subjects for the purpose of this policy include all living individuals about whom GIS HK holds personal data. All data subjects have legal rights in relation to their personal data.

• Personal Data means data relating to a living individual who can be identified, directly from that data, or indirectly from that data in conjunction with other information.

• Data Controllers are the people who, or organisations who, alone or jointly with others, determine the purposes for which, and the manner in which, any personal data is processed. They are responsible for, and must be able to demonstrate compliance with, the data protection principles. GIS HK is the data controller of all personal data used in its business for the company’s own commercial purposes.

• Data Users are GIS HK’s board members, officers or delegates whose work involves processing personal data. Data users must protect the data they handle in accordance with this data protection policy and any applicable data security procedures at all times.

• Data Processors include any person or organisation that processes personal data on GIS HK’s behalf and on the its instructions.

• Processing is any activity that involves use of the personal data. It means carrying out any operation or set of operations on the data including collecting, recording, organising, structuring, storing, amending, retrieving, using, consulting, disclosing by transmission, disseminating or otherwise making available, combining, restricting, erasing or destroying it.

• Sensitive Personal Data includes information about a person’s racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health or sexual life.

Data Protection Principles

As a data controller, GIS HK is responsible for, and must be able to demonstrate compliance with, the six data protection principles. These principles provide that personal data must be:

• Obtained and processed fairly, transparently and lawfully

• Collected for specific, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes

• Adequate, relevant and not excessive

• Accurate and up-to-date

• Not kept for longer than necessary

• Kept safe and secure

Fair, Transparent and Lawful Processing

The GDPR is not intended to prevent the processing of personal data, but to ensure that it is done fairly and transparently.

For personal data to be processed fairly and transparently, GIS HK (as a data controller) must inform data subjects, when it collects personal data directly from them, about all of the following:

• GIS HK is the data controller in regard to the its data and contact details

• The contact details of the Data Protection Officer

• The purpose or purposes for which GIS HK intends to process the personal data and the legal basis

• The legitimate interests pursued by GIS HK or by a third party and an explanation of those interests (where processing is based on this ground)

• Where the processing is based on consent their right to withdraw it at any time

• The third parties or categories of third parties, if any, to whom the firm will disclose the personal data

• Details of any transfers out of the EEA or Hong Kong, the safeguards GIS HK has in place and the means by which to obtain a copy of them

• The data retention period or criteria used to determine same

• The existence of the right to request access to their data; rectification or erasure of their data; restrict or object to processing, and the right to data portability

• The right to complain to the Data Protection Commissioner if they are unhappy with how GIS HK is handling their data

• Details of any automated decision-making, including profiling, and the logic involved, as well as the significance and consequences of such processing for the data subject, and

• Whether the provision of personal data is a statutory or contractual requirement, and the consequences of failing to provide such data

Where GIS HK intends to process the personal data for a further purpose, other than that for which the personal data were collected, GIS HK will provide the data subject prior to that further processing with information on that purpose.

If GIS HK receives personal data about a data subject from other sources, it will provide the data subject with the information at clause 5.2, as well as the categories of personal data concerned, from which source the data originated and, if applicable, whether it came from publicly accessible sources. GIS HK will provide this information to the data subject within one month of obtaining the data; or at the time of the first communication to the data subject (where applicable), or if a disclosure to another recipient is envisaged, when the data are first disclosed.

When processing personal data in the course of GIS HK’s business, it will ensure that these information requirements are met

For personal data to be processed lawfully, it must be processed on the basis of one of the legal grounds set out in the GDPR. These grounds include: where the data subject has given his/her free, informed and unambiguous consent; or if necessary for the performance of a contract with the data subject; or for compliance with a legal obligation to which the data controller is subject; or for the legitimate interests of the data controller or a third party to whom the data is disclosed, except where those interests are overridden by the interests of the data subject.

The processing of Sensitive Personal Data is prohibited unless one of another set of legal grounds set out in the GDPR applies including: the data subject has given his/her explicit consent; or the data have been made public by the data subject; or if necessary for the establishment or defence of legal claims, or to protect the vital interests of the data subject where the data subject is physically or legally incapable of giving his/her consent.

Processing for Limited Purposes

In the course of GIS HK’s business, it may collect and process the personal data set out in the schedule. This may include data GIS HK receives directly from a data subject (for example, by completing forms or by corresponding with GIS HK by mail, phone, email or otherwise) and data GIS HK receives from other sources (including, for example, business partners, counterparties, sub-contractors in technical, payment and delivery services, and others).

GIS HK will only process personal data for the specific purposes set out in the schedule or for any other purposes specifically permitted by the GDPR. GIS HK will notify those purposes to the data subject when it first collects the data or, if it collects the data indirectly, as soon as possible thereafter.

Adequate, Relevant and not Excessive

GIS HK will only collect personal data to the extent that it is required for the specific purpose(s) notified to the data subject.

Accurate and up-to-date Data

GIS HK will take reasonable steps to ensure that personal data it holds is accurate and kept up-to-date. GIS HK will take reasonable steps to check the accuracy of any personal data at the point of collection and at regular intervals afterwards. GIS HK will take all reasonable steps to amend or destroy inaccurate or out-of-date data.

Storage Limitation

GIS UK will not keep personal data for longer than is necessary for the purpose or purposes for which they were collected. GIS HK will take all reasonable steps to destroy or erase the data from its systems when they are no longer required as set out in the Schedule to this Policy.

Data Security

GIS HK will or will require that its delegates will take appropriate technical and organisational security measures, taking in account the risks presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, or stored.

GIS HK’s security measures include, where appropriate:

• The ability to ensure the ongoing confidentiality, integrity and availability and resilience of processing systems and services

• The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident

• A process for testing, assessing and evaluating the effectiveness of technical and organismal measures for ensuring the security of the processing

Where processing is to be carried out on GIS HK’s behalf, it shall only engage processors who provide sufficient contractual guarantees to implement appropriate technical and organisational security measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject.

As a controller, GIS HK is required to enter into a written contract with the processor (including in electronic form), which will set out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects. The contract shall set out, in particular, the specific mandatory obligations of processors laid down in Article 28 of the GDPR.

Processing in line with Data Subject’s Rights

As a data controller, GIS HK is required to process personal data in line with data subjects’ rights, in particular their right to:

• Request access to a copy of any data GIS HK holds about them (see also clause 13)

• Request any inaccurate or incomplete data to be rectified (see also clause 8)

• Object to or request erasure or restriction of processing in specified circumstances

• Request a copy of the data they have provided to GIS HK and transmit those data to another controller without hindrance from GIS HK, or have the personal data transmitted directly from GIS HK to another controller, where technically feasible (i.e. right to data portability)

• Not to be subject to a decision based solely on automated processing, including profiling, which produces a legal effect or other significant effect on the data subject, except where the decision is necessary for the performance of a contract; authorised by EU, Irish or Hong Kong law, or based on the data subject’s explicit consent

• Prevent the processing of their data for direct-marketing purposes

GIS HK will provide the data subject with information on action taken in response to the exercise of any of these rights without undue delay, and at the latest within one month of receipt of the data subject’s request. This period may be extended by two further months where requests are numerous or complex.

Dealing with Access Requests

Data subjects may make a request for information GIS HK holds about them. This request may be made in writing or orally.

When receiving telephone enquiries, GIS HK will only disclose personal data it holds on GIS HK’s systems if the caller’s identity can be verified. If their identity cannot be verified, GIS HK will request the caller to put their request in writing.

A data subject has a right of access to a copy of the personal data GIS HK holds about him/her, as well as the following information:

• The purposes of the processing

• The categories of the personal data concerned

• The recipient to whom the personal data have been or will be disclosed

• The data retention period or criteria used to determine same

• The existence if the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning that data subject or to object to such processing

• The right to lodge a complaint with the Data Protection Commissioner

• Where the personal data are not collected from the data subject any available information as to their source

• The existence of automated decision-making, including profiling the logic involved, and the envisaged consequences of such processing for the data subject, and

• Where personal data is transferred out of the EEA, the data subject must be informed of the appropriate safeguards in place

GIS HK will provide a copy of the personal data free of charge unless a request is manifestly unfounded or excessive, in particular because of its repetitive character, in which case it may charge a reasonable fee, based on administrative costs.

Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information will be provided in a commonly used electronic form.

Transferring Personal Data to a Country Outside the EEA or HK

GIS HK may transfer any personal data the firm holds to a country outside the European Economic Area (EEA) or Hong Kong, provided that GIS HK has informed data subjects of the transfer, the safeguards in place and the means by which to obtain a copy of them, and one of the following conditions applies:

• The non-EEA country to which the personal data are transferred ensures an adequate level of protection for the data subjects’ rights and freedoms. The European Commission deems the following countries to have an adequate level of data protection: Switzerland, Guernsey, Argentina, Isle of Man, Faroe Islands, Jersey, Andorra, Israel, New Zealand and Uruguay. The US is deemed as providing an adequate level of protection where the US recipient of the data is Privacy Shield certified

• Adequate safeguards are in place, such as the Model clauses; Binding Corporate Rules (BCRs); an approved code of conduct or approved certification mechanism with binding and enforceable commitments of the controller or processor in the third country to apply the appropriate safeguards, including as regards data subjects’ rights;

• The transfer is lawful pursuant to one of the derogations in the GDPR, including the data subject has given their explicit consent; the transfer is necessary for the performance of a contract; for public interest reasons; authorised by law; necessary for the defence of legal claims, or to protect the vital interests of the data subject; or

• Where none of the above safeguards or derogations apply, a transfer to a non-EEA country may take place if the transfer is not repetitive, concerns only a limited number of data subjects, and is necessary for the legitimate interest of the controller which are not overridden by the rights of data subjects. The controller must inform the Data Protection Commissioner and the data subject of such a transfer, and the legitimate interests pursued.

Changes to this Policy

GIS HK reserves the right to change this policy at any time. Where appropriate, GIS HK will notify Data Users and/or data subjects of those changes by post or email.